Backdoor

[Robert]

I love the Clipperz service.

As I read the site information, there is not currently back door
through the encryption. Would it be possible for the Clipperz staff to
just upgrade the encryption, and allow a back door without the user
knowing?

Robert

[Giulio Cesare Solaroli]

Hi Robert,

it is obviously possible to update the code and release a new version
of the application that could insert many weakness, or just leak the
relevant information altogether.

We are aware, and we have set up a way for our users to check against
these "fraudulent updates"; it is not perfect, yet, but all the major
stones are already in place, and are listed here:
http://www.clipperz.com/learn_more/reviewing_the_code.

Summing them up here, the involved steps are:
- releasing the (client-side) source code of our application (it is
available for each and every release, so you can even check for
differences between two releases);
- releasing the full build script, allowing you to double check that
the code we release is the code used to build the online application
itself;
- releasing the checksums of the online application, in order for you
to check (before entering your credentials) that the application has
not been altered.

This last point is the weakest, as it is cumbersome to execute (and we
really would like to avoid bothering our users with awkward
operations). We are working to solve it definitely; in the mean while,
we have released a server side script that can help mitigate the
problem: http://groups.google.com/group/clipperz/browse_thread/thread/22c7cff41adf9b3a.

For example, I have bookmarked a "safety" link here:
http://del.icio.us/gcsolaroli/clipperz

On the bookmark itself there is the current checksum of the
application. This script is actually run on the Clipperz's server
itself, so it really does not add a lot to your security issues, but
you are free to install it where you like.

Does this answer your doubts about Clipperz?

Regards,

Giulio Cesare